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In single-qubit quantum secret sharing, a secret is shared between N parties via manipulation 
and measurement of one qubit at a time. Each qubit is sent to all N parties in sequence; the secret 
is encoded in the first participant's preparation of the qubit state and the subsequent participants' 
choices of state rotation or measurement basis. We present a protocol for single-qubit quantum secret 
sharing using polarization entanglement of photon pairs produced in type-I spontaneous parametric 
downconversion. We investigate the protocol's security against eavesdropping attack under common 
experimental conditions: a lossy channel for photon transmission, and imperfect preparation of the 
initial qubit state. A protocol which exploits entanglement between photons, rather than simply po- 
larization correlation, is more robustly secure. We implement the entanglement-based secret-sharing 
protocol with 87% secret-sharing fidelity, limited by the purity of the entangled state produced by 
our present apparatus. We demonstrate a photon-number splitting eavesdropping attack, which 
achieves no success against the entanglement-based protocol while showing the predicted rate of 
success against a correlation-based protocol. 

PACS numbers: 03.67.Hk, 03.67.Dd 



I. INTRODUCTION 

Secret sharing is the general term for a communica- 
tion task in which one participant (the sender) wants to 
share a message with multiple other participants (the re- 
cipients) in a way that forces the recipients to cooperate 
with one another to reconstruct the message. The task 
is relevant when recipients are considered more trustwor- 
thy as a group than individually. In the strongest version 
of secret sharing, the message can be fully reconstructed 
by the full set of N — 1 recipients; however, any subset 
of N — 2 or fewer recipients possesses zero information 
regarding the message. This task can be implemented 
classically by distributing between N — 1 recipients N — 2 
randomly generated bit strings, or 'shadows,' and a final 
(N — l)th 'shadow' string which is the bitwise sum or 
XOR of the other N — 2 strings and the original mes- 
sage. All N — 1 recipients together can reconstruct the 
message by taking the XOR of their shadows; however, 
any proper subset of recipients possesses no information 
about the message. 

Classical secret sharing protocols generally do not in- 
volve the secure transmission of the shadows, leaving this 
task to cryptographic protocols. The emerging field of 
quantum cryptography hinges on the secure transmission 
of information encoded in quantum states. Thus, by us- 
ing quantum states to encode and distribute the shadows, 
secure communication can be built into a secret sharing 
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protocol; quantum-state resources enhance the sharing of 
classical bit-string sequences. Such quantum-mechanical 
resources can be brought to the task of secret sharing in 
several distinct ways. 

The original quantum secret sharing protocol, pre- 
sented in 1999 [l], requires the use of a multipartite en- 
tangled state. Specifically, to share a single-bit secret 
between a sender and N — 1 recipients, the iV-qubit en- 
tangled state ^[|0)i|0) 2 . • . |0)jv + |l)i|l) 2 . . • |1>jv] must 
be produced, and the individual qubits distributed be- 
tween the participants. This quantum secret sharing pro- 
tocol is in principle quite powerful. It allows participants 
to share secrets composed not only of bit values (0 or 
1) but of complete qubits (quantum states of the form 
a\0) +e ztp b\l)). The production of multipartite entangled 
states is unfortunately a technical challenge, requiring an 
experimental tour de force at each realization 0-0] • 

Single-qubit quantum secret sharing (SQQSS), by con- 
trast, was first proposed and demonstrated in 2005 @, II] 
using photon pairs produced by type-II spontaneous 
parametric downconversion (SPDC). The protocol in- 
volves the transmission of a single qubit a\0) + e lip b\l) 
through the entire sequence of participants. The sender 
prepares a state with a specific value of tp and each re- 
cipient performs a simple operation to alter tp. The final 
participant performs a measurement on the qubit whose 
outcome depends on the final value of tp, and the secret 
- the initial tp value - can be reconstructed only when 
all recipients reveal their individual operations. Such a 
protocol uses quantum resources to allow secure shar- 
ing of a classical secret, but does not enable the more 
powerful sharing of a full quantum-state secret. On the 
other hand, SQQSS relies on physical states which can 
be easily produced and manipulated in the laboratory, al- 
lowing for the straightforward realization of the protocols 
and demonstration of their successes and vulnerabilities. 
The original SQQSS protocol, with proposed precautions 
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and coding repetitions @, [l(| , provides security against 
numerous cheating attacks by a subset of recipients. 

In this work, we experimentally implement two varia- 
tions on the protocol of 0, Q , adapted for use with type-I 
SPDC. One version, like the original, relies only on polar- 
ization correlation in photon pairs; the other directly ex- 
ploits the quantum entanglement between photons. We 
note the relative strengths and weaknesses of the two 
versions. In particular, we develop and implement a 
photon-number splitting (PNS) eavesdropping attack; in 
the presence of a lossy transmission channel and imper- 
fect state preparation, this eavesdropping attack works 
against the correlation-based protocol but fails against 
the entanglement-secured version. 



II. SINGLE-QUBIT QUANTUM SECRET 
SHARING SCHEMES USING TYPE-I SPDC 
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FIG. 1: A schematic of the single qubit quantum secret shar- 
ing protocol. The qubit is initially in the state | + x) — 
-^(\H) + \V)), conditioned on coincident detection of the idler 
photon (gating). Each participant applies a relative phase 
shift ipj £ {0, it/2, 7r, 37r/2} to the \V) component. The half- 
wave plate (HWP) and polarizing beam splitter (PBS) allow 
for measurement of the final state in the |±a?) — ;4=(|-ff)±| V)) 
basis. 



Correlation-Based Protocol 
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The SQQSS protocol relies on the secure transmission 
of one qubit to a number of participants sequentially. 
In order to prevent individual participants from cheat- 
ing, however, this signal qubit must be produced and 
detected in correlation with a partner qubit, called the 
idler. In both the original version 0] and our own vari- 
ation, the qubits are encoded in the polarizations of a 
pair of photons produced in SPDC. Thus henceforth we 
will refer specifically to polarization states of photons 
rather than to generic two-state quantum systems. Our 
correlation-based protocol for type-I SPDC closely fol- 
lows the original treatment of pj for the type-II case. 

The sharing of a secret begins with the creation of a 
pair of photons in the polarization-entangled state 



\to) = -L(\HH) + \VV)) 



(1) 



where H denotes horizontal polarization and V vertical 
polarization of each photon. The idler photon passes 
through a polarizer oriented to transmit \H), while the 
signal photon passes through a chain of SQQSS partic- 
ipants. Taken on its own, the polarization state of the 
signal photon as it enters the SQQSS chain is undefined. 
However, the final step in the protocol is the detection 
of the signal and idler photons in coincidence with one 
another. This coincidence detection projects the signal 
photon, at its entry into the SQQSS chain, into the state 
\H). 

The SQQSS chain is shown conceptually in Fig. [1] 
It begins with the sender, who uses a combination of 
waveplates to transform the signal photon to one of the 



X ) = —(\H) + \V)), 
■y) = ±(\H)+i\V)), 

x) = -j=(\H) \V)), 
x) = -j=(\H)-i\V}). 



(2) 



This is equivalent to the preparation of | + x) followed 
by use of a tilt-adjustable phase plate to obtain one of 
|±x),|±y), as shown in Fig. [T] The signal photon 
then passes to N — 1 recipients in turn; each one uses a 
tilt-adjustable phase plate to apply a randomly selected 
phase shift ipj E {0, tv/2, tt, 3-7t/2} so that after partici- 
pant k, the signal photon state is 



\Xk) 
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(3) 



Overall, j ranges from 1 to N to account for the sender 
(i = 1) and N — 1 recipients. The set of four possible 
phase shifts can be broken down into two classes: 



Class X => ipj € {0,7r} 
Classy => <pj e {7r/2,37r/2}. 



(4) 



The sender's choice of state preparation likewise falls into 
either Class X, for creation of | ± x), or Class Y, for 
creation of | ± y) . 

Thus each participant so far possesses a single 'class' 
bit denoting which class they have chosen, but also a 
second 'secret' bit consisting of their phase choice within 
that class. After N participants have applied their local 
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operations, the initial signal photon state \H) is trans- 
formed to the state 



\Xn 



) = -L(\H)+cM^ 3 W)). (5) 



These phase changes are illustrated in Fig. [TJ 

At this point, the final participant measures the polar- 
ization of the signal photon in the | ±x) = (l/y/2)(\H) ± 
\V)) basis, conducting the measurement in coincidence 
with the idler photon as specified earlier. The measurer 
records the measurement outcome, and the physical as- 
pect of the SQQSS is complete. 

Notice that if the final state is of the form 
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(\H)±\V)), 



(6) 



then the measurement outcome will be | + x) or | — x) , 
each with probability 1. However, if 



\ XN ) = ^=(\H)± i \V)), 



(7) 



the final measurement result will be random. 

Therefore, after the measurement is performed, the N 
participants publicly announce the class of the operation 
they applied, and the total number of Class Y operations 
is counted. If the number of Class Y operations was 
even, the run is valid; the N — 1 recipients can expect to 
reconstruct the secret from their shadows. If the number 
of Class Y operations was odd, then the run is discarded; 
this happens half the time on average. 

For valid runs, the remaining 'secret' bit value retained 
by each participant regarding their applied operation 
constitutes that participant's shadow (or the sender's se- 
cret). The last participant also holds the record of the 
measurement outcome. Only if the N— 1 recipients share 
their shadows can they determine the sender's secret, tp\. 

Finally, to prevent cheating, a random subset of the 
bits must be checked. To do this, the first N participants 
announce in random order their actual phase changes ipj 
for a subset of runs randomly selected by the sender. The 
expected measurement result for each run is computed 
and compared to the measurement result announced by 
the final participant. If any recipient attempts to cheat 
by measuring the single-photon state and sending a newly 
prepared version along to subsequent participants, the 
bit error rate rises to at least 25%. Thus, if the protocol 
shows an error rate of less than 25%, cheating of this 
form can be ruled out. 

Restrictions on the order of the class announcements, 
along with repetitions of the protocol with coding en- 
hancements, can be implemented to make the protocol 
more secure, defending even against cheaters with their 
own entangled-pair resources [Toj] . Alternately, the proto- 
col can defend against cheating by a subset of recipients 
(participants 2 through N) via a simpler modification: 
instead of measuring the signal photon, participant N is 



required to transmit it back to the sender, participant 
1. The sender then measures the photon in either the 
| ± x) or | ± y) basis, but all recipients announce their 
class choices before the sender announces the sending and 
measurement classes. Runs with even numbers of Class 
X operations, including the measurement class, are con- 
sidered valid. This protocol defends against cheating, 
even with entangled-pair resources, by any subset of the 
recipients. It privileges the trusted sender of the mes- 
sage, but the sender already occupies a position of trust 
by knowing the original secret, in many if not all possible 
applications. 



B. Entanglement-Based Protocol 

In both type-I protocols, the signal and idler photons 
are first generated as the entangled pair of Eq. [1] In the 
correlation-based protocol, all measurements are done in 
coincidence with detection of the idler photon in the state 
\H). Thus the signal photon is projected into the state 
\H) as well, and then rotated into | ± x) or | ± y) state 
afterwards by means of phase-shifting optics. As pointed 
out in Refs. 0,11], the polarization correlation between 
the signal and idler photons is crucial for the security of 
the protocol; a cheater or eavesdropper, who does not 
have access to the idler photon, therefore has no infor- 
mation on the initial polarization of the signal photon. 
Because the signal photon's initial state is ill-defined, 
subsequent measurements by the cheater cannot reveal 
information about the phase changes applied by sender 
or recipients. 

However, while the correlation-based protocol relies on 
the polarization correlation between signal and idler, it 
does not rely explicitly on the quantum entanglement 
between them. This insensitivity to entanglement per se 
can be viewed as a strength of the protocol, giving robust- 
ness against imperfect entanglement in the form of a lack 
of coherence between the two terms in the superposition 
of Eq. [TJ However, by failing to fully exploit the quan- 
tum entanglement in the initial resource the correlation- 
based protocol passes up a chance for enhanced security 
against eavesdropping attacks, as we demonstrate in the 
next section. 

The entanglement-based protocol which follows makes 
full and explicit use of the entanglement between signal 
and idler in order to prepare the signal photon in the state 
| + x) before it enters the chain of SQQSS participants. 
Unlike a classical mixture, the initial entangled state can 
be rewritten as 



l"'» = 7! (l 



, +x) + 1 -x, -x)). 

Relying on this equality, we orient the idler polarizer to 
transmit only | + x) polarization. Detection of the signal 
photon in coincidence with the idler then projects the 
signal photon into the | +x) state as it enters the SQQSS 
chain. The sender and recipient roles remain the same as 
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before, except that the measurement of the signal photon 
is now conducted in coincidence with the | + x)-selected 
idler. 

The success of the entanglement-based protocol de- 
pends entirely on the presence of entanglement, rather 
than classical correlation, between the signal and idler 
polarizations. To the extent that the initial state is a 
classical mixture of \HH) and |VV), projection of the 
idler photon onto | + x) will leave the signal photon in 
an uncertain polarization state rather than projecting it 
onto | +x) . Thus the success rate, or fidelity, of the secret- 
sharing transmission is sensitive to the purity of entan- 
glement in this protocol. However, the explicit use of 
entanglement makes this protocol robust against certain 
eavesdropping attacks and cheating strategies to which 
the correlation-based protocol is vulnerable. We present 
one such attack, a photon-number splitting exploitation 
of experimental asymmetries, in the next section. 



III. PHOTON-NUMBER SPLITTING 
EAVESDROPPING ATTACK 

The correlation-based SQQSS protocol, in an ideal re- 
alization, provides security against eavesdropping. How- 
ever, the protocol remains vulnerable to attacks that 
may arise due to the imperfections of implementation. 
In quantum communication in general (for example, in 
quantum key distribution), these forms of attack have 
been some of the greatest obstacles to securely imple- 
menting protocols [lll - [l3j . Such attacks include the pos- 
sibility of splitting off and measuring a fraction of the 
photons in a pulse that is sent for each qubit (photon- 
number splitting), or adding photons to the channel and 
later extracting them for measurement (Trojan-Horse at- 
tacks) [HI . Here we focus on robustness against a photon 
number-splitting, or PNS, attack. 

In a PNS attack, an eavesdropper takes advantage of 
the fact that implementations may involve transmission 
of pulses with the possibility of multiple photons per 
qubit. The eavesdropper 'splits' off some of the photons, 
and measures the state of their polarization, while the 
remaining photons pass through to the intended receiver 
untouched. Unless the intended receiver can detect the 
decreased signal size, the eavesdropper gains information 
about the message without alerting the participants to 
her presence. 

There are many ways of avoiding PNS attacks in quan- 
tum key distribution, including decoy states, strong ref- 
erence pulses, and differential phase shifts [H, fig . The 
correlation-based protocol protects against PNS by ref- 
erencing the signal photon to the idler photon, which 
is passed through a polarizer before being detected. A 
PNS eavesdropper cannot discover whether her 'picked- 
off' signal photons are coincident with the correct idler 
photons; thus she gains no information about the polar- 
ization state of the signal @. 

However, this protection is only completely valid in the 



case for which the two photons are produced with perfect 
symmetry in their polarization states, as in Eq. [1] Given 
common issues in the production of this entangled state, 
the photons may actually be in the state 

|^0,asymm) = a\HH) + y/ 1 - a 2 \VV) (9) 

with a 2 7^ 1/2. This state may be the overall two-photon 
state produced, or the emitted state may be symmetric 
but with correlations between polarization and other de- 
grees of freedom (such as energy or spatial mode) which 
make it possible for an eavesdropper to filter her detec- 
tion so she is dealing with an asymmetric state. In ei- 
ther case, the difference in the probability of detecting 
the signal photon in its two polarization states can give 
information to an eavesdropper. An eavesdropper, Eve, 
can gather this information by splitting off some photons, 
and using a beamsplitter to measure half of them in the 
| ± x) basis and the other half in the | ± y) basis. 



A. Attack on Correlation-Based Protocol 

To quantify this attack, let us assume that Eve is eaves- 
dropping on the correlation-based protocol, just after the 
sender has applied a phase shift to the photon. We want 
to find the probability that for a given a 2 7^ 1/2 and 
n photons measured by Eve, Eve can distinguish what 
state the sender has prepared. If she can reliably deter- 
mine the qubit state, she has intercepted the secret. Eve 
will attempt to distinguish the qubit state by counting 
the number of photons detected in each of her four de- 
tectors (corresponding to measured photon state | + x) , 
| — x) , | + y) and | — y) ) . She will then guess the bit value 
associated with the detector which registered the greatest 
number of counts. This is not the only possible algorithm 
for deciding which bit value Eve will guess; however, this 
algorithm does yield better-than-random results for Eve 
whenever the vulnerability a 2 7^ 1/2 exists. 

We assume for the sake of simplicity that the sender 
applies phase shift, and thus Eve intercepts the signal 
photon which is the second member of the entangled state 

=a\+x,H) + Vl-a 2 \-x,V). (10) 

(If the sender applies a different phase shift, the polar- 
ization states will be different, but Eve's success in iden- 
tifying the correct bit does not change.) Given that the 
idler photon remains unmeasured, we can then find the 
probability that Eve measures the signal photon in either 
| + x) or | — x) , as well as in either | + y) or | — y) . If the 
photon goes to the | ± x)-basis detectors, the probability 
of registering | + x) is 

p{\+x)) = (iP 1 \P +x , 8 ®I i \i> 1 ). (11) 

This evaluates simply to a 2 , and similarly the probability 
of registering | — x) is 1 — a 2 . If the photon goes to the 
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| ± y)-basis detectors, the probability of measuring | + y) 
is 

y{\ + y))=mP+y, s®h\^i) (12) 
_ a 2 + (l-a 2 ) 
2 

=1/2, 

and the probability of measuring |— y) is likewise 1/2. For 
the eavesdropper, then, for any single intercepted photon 
the probabilities of detection in | + x) , | — x) , \ + y) , and 
| - y) are a 2 /2, (1 - a 2 )/2, 1/4, and 1/4, respectively. 

Let us assume that n total photons can be diverted and 
detected by Eve. The probability of registering i counts 
in the | + x) detector, j counts in the | — x) detector, k 
counts in the | + y) detector, and I counts in the | — y) 
detector is 




Eve will successfully identify the secret if the | + x) 
detector registers the most counts (i > j, k, I), but also if 
the | + y) detector registers the most counts (I > k), 
since either + result maps to the same secret bit value. 
To exactly predict Eve's success rate, however, we must 
also consider the possibility that two or more detectors 
tie for the most counts. In this case, we let Eve randomly 
select one of the tying detectors and base her bit-value 
guess on that detector. With this strategy in mind, we 
can assign to each outcome a probability of occurring, 
and a likelihood for Eve to succeed in that case. 

Thus we can calculate the probability PEvc.n for Eve to 
successfully identify a bit by intercepting n = i + j + k + l 
photons to be (pi indicates the probability that i > j, k, I, 
while Pi=j indicates the probability that i — j > k,l, and 
so forth): 

PEve,n = ~ [1 + Pi ~ Pj + Pi=k - Pj=k] 

+ i [pi=k=i - P]=k=i] 

«i [1 + pi - pj] , for large n. (14) 

The final approximation simply neglects ties between the 
detectors, which become rare in the limit of large n [l7| . 
Finally, we use Eq. [13] to evaluate the probabilities Pi, 
etc. in Eq. [TH A plot of Eve's predicted success rates 
as a function of a 2 , for various numbers of 'picked-off' 
photons per qubit, is shown in Fig. [5J 

We have focused on Eve's success rate when a 2 > 1/2; 
however, if a 2 < 1/2 Eve will have exactly the same suc- 
cess rate if she systematically reverses her bit-guessing 
strategy. Thus Eve can be successful as long as (i) some 
\HH) vs. \VV) asymmetry exists in the initially pro- 
duced two-photon state and (ii) she is able to indepen- 
dently gauge the success of a small number of her guesses 
in order to decide whether or not to reverse her guessing 




0.5 0.6 0.7 0.8 0.9 1.0 



2 

a 

FIG. 2: Bitwise probability of successful secret identifica- 
tion by Eve, using a photon-number splitting attack on the 
correlation-based SQQSS protocol. Eve's success rate is 
shown as a function of a 2 , the probability of \HH) in the 
emitted entangled state (as filtered by Eve's detection). Be- 
cause the calculation is symmetric in a 2 and b 2 = 1 — a 2 , 
P(l - a 2 ) = P(a 2 ) can be used to give the probability of 
success for a 2 < 0.5. Eve's success rates are shown for 
n = (10,25,50,100) where n is the number of photons de- 
tected in Eve's apparatus for each qubit. An eavesdropper 
detecting an asymmetric two-photon initial state with a good 
signal-to-noise ratio (points) achieves results in close agree- 
ment with theory (curves). 



strategy (a common tactic in codebreaking scenarios) . If 
Eve can listen in on classical communications between the 
secret-sharing participants, for instance, the runs used 
for checking error rate should allow her to determine the 
correct guessing strategy. 

It is clear that photon number splitting requires access 
to many photons. For a 2 = 0.6, measuring 100 photons 
gives Eve a theoretical 78% success rate for determining 
the secret bit value. The attack is especially strong when 
a pulse of large, indefinite photon number must be sent 
for each qubit. 



B. Robustness of Entanglement-Based Protocol 

The correlation-based protocol for type-I SPDC is par- 
ticularly vulnerable to our PNS attack because state 
asymmetry of the type denoted by Eq. [H] with a 2 ^ 1/2 
is particularly common. For example, it tends to arise 
from unequal thicknesses or orientations of the two crys- 
tals used for SPDC, or from imprecision in the input 
polarization of the SPDC pump beam. The same type 
of asymmetric initial state arises in type-II SPDC, for 
example from imperfect alignment of the signal and idler 
paths with the positions of perfect overlap of the type-II 
output cones. Even in systems for which the overall state 
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has good symmetry, more troubling is the existence of 
correlations between photon polarization in the H/V ba- 
sis and other degrees of freedom, particularly for pulsed 
sources [1 81 - 4201 ] , which otherwise provide an added advan- 
tage of well-defined pulse arrival times. Correlations of 
this sort allow the eavesdropper to measure an effectively 
asymmetric state by filtering her detection on a second 
degree of freedom. A typical defense against this issue is 
to strongly pre-filter the entangled state at its source, but 
this solution drastically reduces source brightness and 
secret-sharing transmission rate. Schemes have been pro- 
posed to eliminate unwanted correlations without loss of 
brightness (UMlll, and improvements via these schemes 
have begun to be demonstrated experimentally [13, HE] ■ 
However, it is of interest to explore an approach that im- 
proves the security of single-qubit quantum secret shar- 
ing without recourse to either a loss of brightness or these 
additional complications. 

Asymmetry between the two terms in the initial su- 
perposition or in Eve's detected state gives rise to a bias 
in the signal photon's polarization state - even when ob- 
served without coincidence detection. This bias is ex- 
ploited by the PNS eavesdropper. By contrast, if a 2 ^ 
1/2 in the (possibly filtered) state but the entanglement- 
based protocol is followed, the single-particle state of 
the signal photon remains randomly distributed between 
| + x) and | — x) before the actions of the SQQSS partic- 
ipants. This can be seen quite simply by rewriting the 
state in the { | + x) , \ — x)} basis for each photon: 



(a) 



lin. pol. 



|V>0,a S ymm) =a\H H) + y/l - 0?\VV) 

= - (a + v 7 ! - a 2 ) (I +x,+x)+\- x, -x)) 

(15) 

+ i (a - y/l - a 2 ) (| +z,-x)+\- x, +x)) . 

It can easily be seen from this expression that the signal 
photon is found in | + x) 50% of the time and | — x) 50% 
of the time, if no polarization information is gathered for 
the idler. 

Indeed, if the initial entangled state were asymmetric 
in the x basis, there would be a parallel PNS eavesdrop- 
ping attack, but asymmetries in the x basis are much 
less likely simply because of the physical way in which 
the entangled pair is produced via SPDC. Therefore the 
entanglement-based protocol, while it makes the fidelity 
of the transmission more sensitive, also provides built-in 
security against common exploitations by an eavesdrop- 
per. 



IV. EXPERIMENTAL IMPLEMENTATION 

A. Realization of Correlation-Based SQQSS 

We now turn to implementations of both correlation- 
based and entanglement-based protocols with a secret 
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FIG. 3: (a) Experimental setup for the correlation-based pro- 
tocol. The sender is composed of the first 810-nm HWP along 
with the first YVO4 crystal. Additional YVO4 crystals are the 
phase-shifting recipients in the protocol. The idler polarizer 
is set to accept horizontal polarization, which projects the 
signal photon into \H) at its entry into the SQQSS chain, (b) 
In the entanglement-based protocol, the idler polarizer is set 
to accept I +2:) polarization, projecting the signal photon into 
\+x) at its entry into the SQQSS chain. The sender prepares 
the state using just the first YVO4 crystal. 



sender and two recipients. An experimental schematic 
for the correlation-based SQQSS is shown in Fig. [3] En- 
tangled photon pairs are produced via type-I degener- 
ate spontaneous parametric downconversion [26j in a pair 
of 0.5mm-thick BBO crystals pumped with a 50mW cw 
diode laser at 405nm. A 405-nm half waveplate and a 
tiltable quartz phase plate control the input pump beam 
polarization; these are set to prepare the initial entan- 
gled state of Eq. [1] for the signal and idler photons at 
810nm. The BBO crystals are cut at 29.15° for non- 
collinear downconversion, with the signal and idler at 3° 
from the pump beam path. 

A Glan-Thompson polarizer in the idler beam path al- 
lows selective detection of \H) for the idler photon. An 
810-nm half waveplate in the signal arm converts \H) to 
I + x) . Now the sender and two recipients apply phase 
shifts ipj £ {0, 7r/2, 7t, 37r/2}. Each phase shift is accom- 
plished using a 200-micron-thick uniaxial YVO4 crystal. 
The tilt of each crystal about a vertical axis is controlled 
to obtain the desired phase shift. A compensation YVO4 
crystal corrects for time spreading between the polar- 
izations. The final recipient measures the signal photon 
polarization in the | ± x) basis using an 810nm half wave- 
plate and a polarizing beamsplitter, sending signal pho- 
tons into one of two detectors. Signal and idler photons 
are detected by coupling into multimode fibers en route 
to single-photon counting modules and coincidence detec- 
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FIG. 4: Experimentally observed fidelity, or probability of 
'sharing' the correct qubit, using the entanglement-based pro- 
tocol. Fidelity is displayed as a function of the phase-shifting 
angle of each YVO4 phase plate, averaged over all settings 
of the other YVO4 phase plates. The overall 13% qubit er- 
ror rate is well below the 25% rate for reliable detection of 
cheaters. Variation of fidelity between phase plate settings 
matches predictions based on precision of phase plate tilting. 
The overall fidelity matches predictions based on phase spread 
in the initial two-photon entangled state. 



tion with a time resolution of 4ns. The overall efficiency 
of detection is approximately 2%. 



B. Realization of Entanglement-Based SQQSS 

An experimental schematic for the entanglement-based 
protocol is shown in Fig. [3J The polarizer in the idler 
arm is rotated to select | + x) idler polarization. The 
810nm half waveplate in the idler arm is no longer neces- 
sary, so the sender is realized entirely by the first tiltable 
YVO4 phase plate. All other aspects of the setup remain 
unchanged from the correlation-based experiment. 

To measure the rate of success in secret sharing, many 
runs with different secret and shadow bits were car- 
ried out using automated experiment control and data 
acquisition. For each run, secret and shadow bits, as 
well as the auxiliary Class X/Y bits, were chosen ran- 
domly. The random number choices determined settings 
for the YVO4 crystals, which were tilted using software- 
controlled motorized rotation platforms. All measure- 
ments were done by counting coincidences between the 
idler channel and the two signal channels over a minimum 
time interval of 0.1 s, limited by data acquisition tech- 
niques. Per-photon probabilities of detection were cal- 
culated, when necessary, from the observed coincidence 
rates. 

Observed success rates for the entanglement-based pro- 
tocol are shown in Fig. 01 The overall error rate of 13% 
is well below the 25% threshold for reliable detection of 
cheaters, so secret-sharing has been realized in this im- 
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FIG. 5: (a) Schematic for measuring purity (mixedness) of 
two-photon entangled state, due to uncompensated spread in 
phase <j> of state -j=(\HH) + e"?\VV}). Coincidence counts 
between signal and idler photons are measured with the idler 
linear polarizer fixed at 0° or 45°; a half waveplate in the 
signal arm is rotated to change the linear polarization trans- 
mitted through the polarizing beamsplitter, (b) Coincidence 
counts observed. Diminished fringe visibility with the idler 
polarizer at 45° gives a purity of 0.78 for the two-photon state, 
accounting for our observed secret-sharing error rate. 



plementation. Variations in success rate of 3-6% are ob- 
served from one set of phase plate settings to another. 
This variation is predicted from the limited precision of 
tilt angles for the YVO4 phase plate crystals. 

The imperfect 87% fidelity of secret sharing can be at- 
tributed to imperfect entanglement, or purity P < 1, of 
our entangled state produced by SPDC. For our appa- 
ratus, the BBO crystal thickness and pump laser band- 
width produce a spread in phase between \ HH) and | VV) 
components, so that our two-photon state is only par- 
tially entangled. Separate measurements of the entan- 
gled state (see Fig. [5]) indicate a purity P = 0.78, or 
entangled-state fidelity F = 0.87 [27|], consistent with 
the 87% secret-sharing fidelity we measure in the exper- 
iment. 



C. Eavesdropping 

A maximal implementation of the photon number 
splitting attack is shown in Fig. [5] First, some fraction 
of the photons traveling through the apparatus would be 
picked off through the use of a polarization-preserving 
beamsplitter placed immediately after the first (sender) 
YVO4 phase plate. The picked-off photons would be di- 
rected into Eve's polarization-analyzing detection appa- 
ratus. A 50-50 beam splitter (BS) sends half of the in- 
tercepted photons to be measured in the | ± x) basis and 
the other half to be measured in the | ± y) basis. The 
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FIG. 6: Ideal eavesdropping setup for photon number split- 
ting attack. Eve picks off a fraction of the transmitted pho- 
tons and measures half of them in the | ± x) basis, half of 
them in the | ± y) basis. If the correlation-based protocol is 
used, Eve can exploit an imperfectly prepared initial state to 
determine the secret bit with better than random success. 
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FIG. 7: Experimental setup to simulate a photon number 
splitting eavesdropping attack on the correlation-based pro- 
tocol. The 405-nm HWP is rotated for different values of 
a 2 in the initial state. The last two YVO4 crystals are held 
at a constant position to give a phase shift of ip = 0. For 
eavesdropping on the entanglement-based protocol, the first 
810-nm HWP is removed. Detection is carried out in coin- 
cidence with the idler photon to improve signal-to-noise, but 
no idler polarizer is used to simulate an eavesdropper with no 
access to idler state information. 



measurement in the | ± x) basis is done using a half- wave 
plate, polarizing beamsplitter, and two detectors. The 
measurement in the | ± y) basis is done using a quarter- 
wave plate, polarizing beamsplitter, and two detectors. 
Eve then counts the number of photons that entered each 
detector and guesses a secret bit based on the detector 
registering the most counts. 

To implement a photon number splitting attack exper- 
imentally, we simulated the success of the Fig. [6] eaves- 
dropper via a simplified experimental setup. Rather than 
performing SQQSS detection as well as simultaneous de- 
tection in two bases by Eve, we omitted the final SQQSS 
measurement and conducted measurements in each of 
Eve's two bases at different times in the actual exper- 
iment. 

The modified eavesdropping schematic is shown in 
Fig. [7] The 405-nm half waveplate was rotated to obtain 
different values of a 2 . The sender's 810-nm half wave- 
plate was present for the correlation-based protocol only. 
Two of the three YVO4 crystals, left in place for con- 
venience, were held at a constant position to introduce 
a phase shift of 0°. The first YVO4 crystal was tilted 
to produce the four possible phase shifts introduced by 
the sender. An 810-nm quarter waveplate at 45° allowed 
measurement in the | ± y) vs. | ± x) basis to be decided 
by rotation of the final 810-nm half waveplate. 

To approximate an eavesdropper with perfect signal- 
to-noise on her polarization analysis, we measured the 
signal photon in coincidence with the idler, but with no 
idler polarizer since the eavesdropper lacks access to the 
idler's polarization information. Thus the coincidence 
detection improved signal-to-noise problems due to back- 
ground light, but otherwise faithfully simulated an eaves- 
dropper's action. 

A single run of the eavesdropping scheme consists of: 
tilting the sender phase plate, setting the eavesdropper 
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n = 10, 25, 50, or 100 photons per qubit, for the entanglement- 
based protocol. Note the change of vertical scale from Fig. [2] 
Here the eavesdropper is no longer successful despite asymme- 
try in the initial two-photon state. The very small deviations 
from 50% success can be attributed to imperfect alignment of 
the apparatus. 



half waveplate to collect count rates in | ±a;) for 50 s, and 
then rotating the eavesdropper half waveplate to collect 
count rates in | ± y) for 50 s. The observed count rates 
for each sender phase setting were then used as inputs 
to a Monte Carlo simulation of Eve's success rate for a 
small number of detected photons. 

Observed success rates for Eve are shown here for the 
correlation-based measurement (Fig. [5]) and likewise for 
the entanglement-based measurement (Fig. [3]). The im- 
perfect entangled-state purity seen in Fig. [5] does not 
affect eavesdropping success. Hence the experimentally 
inferred success rates closely follow the theoretical pre- 
dictions discussed above. 
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V. CONCLUSIONS 

We have demonstrated two SQQSS protocols using 
entangled photon pairs from type-I SPDC. A photon- 
number splitting attack on these protocols, exploiting 
lossy transmission and asymmetric state preparation, is 
demonstrated. The entanglement-based scheme is robust 
against this attack while the correlation-based scheme is 
not; this contrast illustrates the value of using quantum 
entanglement for security of communication. 

An imperfect entangled state (P < 1) causes low- 
ered fidelity of secret-sharing for the entanglement-based 
scheme. Specifically, in this work, P = 0.78, input state 
fidelity F — 0.87, leads to secret-sharing fidelity of 87%. 
Improved purity at the P w 0.95 level should be possi- 
ble in this apparatus with relatively minor modification, 
such as addition of a compensation BBO crystal in the 
pump beam to remove time/energy phase spread [28l - [30j . 
Such an improvement should lead to a secret-sharing fi- 
delity of ~97%, at which point imprecision in component 
positioning will limit the overall fidelity in practice. 

To further probe the strengths and weaknesses of 
entanglement-secured SQQSS, other attack strategies 



must be developed and implemented, or a more general 
security analysis including both internal and external at- 
tacks must be conducted. Further work can also address 
scaling of SQQSS with the number of participants, and 
variations of SQQSS in which information is encoded in 
multiple entangled degrees of freedom of the photon pair. 
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